Del prototipo con IA a producción: las ocho capas que añado, en este orden

-- Members only see invoices of their own organisation
alter table invoices enable row level security;

create policy "members read own org invoices"
  on invoices for select
  using (
    org_id in (
      select org_id from memberships
      where user_id = auth.uid()
    )
  );

# Nightly: dump, encrypt, ship to another provider, prove it restores
pg_dump "$PROD_DB_URL" --format=custom --file=prod.dump
age -r "$BACKUP_PUBKEY" -o prod.dump.age prod.dump
aws s3 cp prod.dump.age "s3://backups-offsite/$(date +%F)/" \
  --endpoint-url "$OFFSITE_S3_ENDPOINT"
pg_restore --clean --if-exists --no-owner -d "$RESTORE_TEST_DB_URL" prod.dump
psql "$RESTORE_TEST_DB_URL" -c "select count(*) from public.bookings;"

# .github/workflows/ci.yml (excerpt)
on: pull_request
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22 }
      - uses: supabase/setup-cli@v1
      - run: npm ci
      - run: npm run typecheck && npm run lint && npm test
      - name: Migration dry run against staging
        run: supabase db push --dry-run --db-url "$STAGING_DB_URL"
        env:
          STAGING_DB_URL: ${{ secrets.STAGING_DB_URL }}